Corrected October 30, 2026. The original publication date is retained.
SSAE No. 22 revised AT-C section 210 for limited-assurance review engagements. It did not replace SSAE 18 as a whole or turn SOC 1 and SOC 2 examinations into review engagements. The earlier version of this article incorrectly applied the review changes to both SOC reports.
The standard was issued in December 2020 and became effective for review reports dated on or after June 15, 2022. See the AICPA overview of SSAE 22 for the scope and effective date.
What Changed in a Review Engagement?
SSAE 22 clarified the procedures a practitioner may perform, required a more informative description of the work supporting the conclusion, and addressed adverse conclusions when misstatements are material and pervasive. Procedures can extend beyond inquiry and analytical work where needed.
A review provides limited assurance. An examination provides reasonable assurance. The engagement type affects the work performed and the report issued; the two should not be described interchangeably.
What Does This Mean for a SOC Engagement?
SOC 1 and SOC 2 are examination engagements. SOC 1 addresses controls relevant to user entities’ internal control over financial reporting. SOC 2 addresses controls relevant to the applicable Trust Services Criteria. Their requirements should be identified from the standards and guidance applicable to that examination, rather than inferred from a higher SSAE number.
What Should You Ask Your Auditor?
- Which report and engagement type are we commissioning?
- Which standards and criteria apply to the service and period in scope?
- Does a particular standards update change our engagement, or does it concern another type of service?
Record those answers in the engagement plan. There is no need to rename a SOC report “SSAE 22” merely because that standard was issued. The AICPA SOC resource library provides current reporting resources.
SSAE 22 should not be confused with the SOC reporting engagements described in the SOC 1 and SOC 2 guides.